Traffic to IP addresses matching local network not sent over VPN

After some extensive testing the only solution I got to work is a VM setup.

1. Setup the NordVPN GUI client or Tunnelblick and connect to the Swedish VPN-server (preferably with an openvpn connection). Often VPN-providers use a NAT firewall - which means you are first connected to an internal network. You can get the network with ifconfig. In your above example that's a 10.0.0.0/8 network (10.250.250.88 --> 10.250.250.1 netmask 0xff000000). Check that all network traffic is sent to the VPN provider.
2. Download and install a type-2 hypervisor like VirtualBox or Parallels Desktop

3. Set up the NAT network of the hypervisor with different network settings than the internal network of the VPN provider, your own network and your school's network.

   Examples:

   Parallels:

   

   VirtualBox:

   

   Possible networks may be private networks in 172.16.0.0/12 (e.g. 172.18.8.0/24)

4. Create a new VM hull and attach it to this NAT network.
5. Install a familiar OS (e.g OS X 10.9-10.11) in this VM
6. Set up a VPN connection in the VM to your school's VPN server in Sweden in the VPN in System Preferences -> Network, shut down the VM and quit the hypervisor.
7. Connect to NordVPN in the non-virtualized OS
8. Start the VM
9. Connect to the school's VPN server in the virtualized OS

tested with a Parallels VM (OS X 10.11) and a private VPN server (Cisco IPSec) and an iMac (OS X 10.9) and VyprVPN (OpenVPN)

It should be possible to create a bridge with en0 and en2 and enable net.inet.ip.forwarding to get rid of all routing problems. The bridge acts more or less as another switch between en0 and en2.

• Disable Internet Sharing
• remove the gateway in the en2 settings of the Mac mini and change the IP-address to an available one in 192.168.88.0/24 (e.g. 192.168.88.11)
• remove all additional static routes
• Check for bridge interfaces with ifconfig

• On the server create a file bridge:

  sudo mkdir -p /usr/local/bin/ #only if the folder is missing
  sudo nano /usr/local/bin/bridge
  

  with the content

  #!/bin/bash
  
  sysctl -w net.inet.ip.forwarding=1
  ifconfig bridge create
  ifconfig bridge0 addm en0 addm en2 up #use the first available bridge number here and the proper interface device names
  

• enter sudo chmod +x nano /usr/local/bin/bridge

• Create a launch daemon usr.bridge.plist:

  sudo nano /Library/LaunchDaemons/usr.bridge.plist
  

  with the content

  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
  <plist version="1.0">
  <dict>
      <key>Label</key>
      <string>usr.bridge</string>
      <key>ProgramArguments</key>
      <array>
          <string>/bin/sh</string>
          <string>-c</string>
          <string>/usr/local/bin/bridge</string>
      </array>
      <key>RunAtLoad</key>
      <true/>
      <key>StandardErrorPath</key>
      <string>/tmp/usr.bridge.err</string>
      <key>StandardOutPath</key>
      <string>/tmp/usr.bridge.out</string>
  </dict>
  </plist>
  

• Load the plist

  sudo launchctl load /Library/LaunchDaemons/usr.bridge.plist
  

• Change the IP-addresses of node_1 and node_10 to available ones in 192.168.88.0/24 (e.g. 192.168.88.101 and 192.168.88.110). Change their default gateways to 192.168.88.1 and the DNS server to 192.168.88.10.